Privacy policy
Last updated: 2026-11-04
Who is responsible
[not set up yet], [not set up yet] ("we") is responsible for the processing of personal data described here. For questions and requests about your data, write to [not set up yet].
We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).
What we process, and why
- Your account: your e-mail address, your name and company, a secure hash of your password (never the password itself), when you last signed in, and your projects and roles. We need them to let you sign in and to give you the right access.
- Project content: the models, versions, reviews, comments and results you and your colleagues store. They are processed on behalf of your organisation, only to provide Tron; your organisation decides about them.
- Activity log: who did what and when (for example sign-ins and changes of people and roles), with the network address and browser of the request. It keeps Tron secure and lets your organisation trace changes. Network addresses and browser details are removed after 180 days.
- Failed sign-ins: the address entered and the network it came from, kept for a day, to stop people guessing passwords.
- Usage: how many requests, changes and calculations each person made per month. Your organisation's administrators can see it.
- Emails: invitations, password links and notifications (for example about reviews or expiring access). We keep a record of which email was sent when, never its content.
- Licence check: once a day this server tells the provider of Tron its licence key, address, version and licence state, how many people it has, how many of them were active in the last 30 days and how many seats changed, to check its licence. No names, addresses or project content are sent. A server with an offline licence file sends nothing.
- Notifications: what happened in your projects, shown to you in Tron. We keep your newest 200.
- Access tokens: only a secure hash of each token is kept, never the token itself.
Cookies
Tron uses one cookie, to keep you signed in in your browser (for 12 hours at most), a short-lived one during two-factor authentication, and one that recognises a browser you signed in with before, for up to a year, so that someone else's wrong passwords do not stop you from signing in. There are no tracking, advertising or analytics cookies.
Where the data is, and who else processes it
- Hosting: [not set up yet].
- Email delivery: emails are delivered through our email provider.
- AI agents you connect: when you connect an agent such as Claude to Tron, the agent reads and changes your projects on your behalf. What the agent's provider does with that data is governed by your agreement with that provider.
We do not sell personal data and do not use it for advertising.
How long we keep it
Account data is kept while you are a member of the organisation or a project. When you are removed, your name and address are deleted, and your contributions stay in project history under a neutral name. Entries in the activity log remain until they expire. Project content is kept as long as your organisation keeps the project; a deleted project can be restored for 30 days, then it is erased. Backups are kept for 14 days. The activity log is kept for 365 days, the record of emails for 180 days, and usage per person for 24 months. Your organisation can change these periods.
Your rights
You may ask what data we keep about you, have it corrected or deleted, and receive it in a common format: your account page offers a download of your data. You may object to processing, and you may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, to your data protection authority.
Security
Connections are encrypted (HTTPS). Passwords are stored only as secure hashes, and two-factor authentication is available. Access to projects follows roles.
Changes
We may update this policy; the date above shows the current version.